External reconnaissance

Nmap

Get the standard ports and run all the scripts and checks on them:

nmap -n -v -sT -sV -A <IP or FQDN> -oN nmap | tee "nmap_$(date '+%Y-%m-%d_%H-%M-%S').txt"

Get a full TCP scan:

nmap -n -v -sT -sV -p- -Pn -A -T5 -sC <IP or FQDN> -oN nmap | tee "nmap_$(date '+%Y-%m-%d_%H-%M-%S').txt"

Using a file with IP list:

nmap -n -v -sT -sV -p- -Pn -A -T4 -sC -iL <filename.txt> -oN nmap | tee "nmap_$(date '+%Y-%m-%d_%H-%M-%S').txt"

Get a SYN scan:

<aside> ℹ️

The SYN scan sends a SYN packet (which is the first part of the TCP handshake sequence) to a port, and analyzes the response to determine whether the port is open, closed, or filtered.

</aside>

nmap -v -A -O -sV -p- -T4 -Pn -sS -sC <IP or FQDN> -oN nmap | tee "nmap_$(date '+%Y-%m-%d_%H-%M-%S').txt"

Get Stealth Scan:

nmap -v -A -O -p- -T4 -Pn -sS -sC <IP or FQDN> -oN nmap --scan-delay 3s --max-parallelism 1 -Pn | tee "nmap_$(date '+%Y-%m-%d_%H-%M-%S').txt"

AutoRecon - by Tib3rius

Tib3rius/AutoRecon: AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.

Network Recon - by padowla